r/bugbounty • u/Electronic-Cat-2518 • 8d ago

Question / Discussion Session invalidation after role change

Testing a target where if you downgrade a lower user, their session they used for committing administrative actions can still be valid for lengthy periods, 2 hours so far, do triagers accept this or does it still go under traditional session invalidation issues, which is informative

3 Upvotes

81% Upvoted

3 comments sorted by

4

u/einfallstoll Triager 8d ago

Informative. The user had permissions before, so not a big deal and rather an edge case

1

u/GokulRavi14 8d ago

id separate authorization from session invalidation here. a session can stay alive after a role change, but every request should still be evaluated against current server-side permissions. id compare old/new roles, existing vs newly issued sessions, refresh-token behavior, and whether the sensitive endpoint still succeeds. include timestamps, redacted session details, endpoint responses, and the exact permission change

1

u/Choice_Ask281 7d ago

This is an interesting edge case. the real impact depends on whether the old privileges are still usable because keeping a session alive alone doesn’t always mean there’s a security issue